Toward Comprehensive Risk Assessments and Assurance of AI-Based Systems

2026-06-28

AI Summary

This study addresses critical limitations in current AI risk assessment methodologies, which often misapply traditional safety frameworks, leading to incomplete risk coverage and erroneous safety conclusions due to terminological imprecision and inadequate contextual fit. To overcome these issues, this work proposes the first end-to-end risk assessment framework that extends the concept of Operational Design Domain (ODD)—originally developed for autonomous vehicles—to general-purpose AI systems. By explicitly defining the intended operating conditions of AI systems, the framework establishes well-demarcated safety boundaries. It integrates principles from systems safety engineering, cybersecurity, and AI governance, harmonizing technical, societal, and ethical dimensions into a unified, rigorous terminology and a structured evaluation process. The resulting methodology offers a comprehensive risk assessment tool applicable across diverse AI domains, significantly enhancing developers’ and auditors’ ability to understand, validate, and credibly substantiate safety claims—thereby avoiding misleading assurances of security.

Abstract

Novel safety, socio-economic, and ethical harms arising from the deployment of AI-based systems have led to a breadth of work seeking to map, measure, and mitigate against newly found risks. These works have heavily leveraged techniques and terminology from the fields of System Safety Engineering and Cybersecurity, yet they have fallen short in accounting for the limitations and nuances that reduce the efficacy and correct application of adopted methodologies. Furthermore, misuse of terminology entailing compliance with established safety and security properties can mislead stakeholders with regard to the claims an AI system satisfies and provide a false sense of safety. In this paper, we seek to align overlapping, AI-adjacent communities on a consistent and comprehensive assurance terminology crucial for the safe deployment of AI-based systems. We outline why previous attempts to adapt risk assessment techniques and terminology from the safety and security fields have been insufficient. We then propose a novel end-to-end AI risk framework that integrates the concept of an Operational Design Domains (ODD), initially introduced for ADS (Automated Driving Systems) [1], for more general AI-based systems. The purpose of an ODD is to provide a description of the specific operating conditions for which an AI-system is designed to properly behave, thus outlining the safety envelope for which system hazards and harms can be determined against. We believe that by defining a more concrete operational envelope, developers and auditors can better assess potential risks and required safety mitigations for AI-based systems.

Problem

• AI safety
• risk assessment
• assurance terminology
• Operational Design Domain
• system hazards

Innovation

• Operational Design Domain
• AI risk framework
• assurance terminology
• system safety
• risk assessment